Creio que me expressei mal.
Não sou um especialista em infra, mas conheço os logs e não encontro nada que justifique.
O que eu estou vendo é uma série de tentativas frustradas de entrar no servidor, que você pode ver nesse trecho do proftpd.log:
016-04-14 14:00:11,253 ip-172-30-2-151 proftpd[8622] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session opened.
2016-04-14 14:00:11,357 ip-172-30-2-151 proftpd[8621] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session closed.
2016-04-14 14:00:11,466 ip-172-30-2-151 proftpd[8622] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): USER conhecen: no such user found from host1.webinformativomarketing.com [95.110.236.43] to ::ffff:172.30.2.151:21
2016-04-14 14:00:11,968 ip-172-30-2-151 proftpd[8623] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session opened.
2016-04-14 14:00:12,075 ip-172-30-2-151 proftpd[8622] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session closed.
2016-04-14 14:00:12,191 ip-172-30-2-151 proftpd[8623] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): USER conhecen: no such user found from host1.webinformativomarketing.com [95.110.236.43] to ::ffff:172.30.2.151:21
2016-04-14 14:00:12,541 ip-172-30-2-151 proftpd[8624] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session opened.
2016-04-14 14:00:12,653 ip-172-30-2-151 proftpd[8623] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session closed.
2016-04-14 14:00:12,753 ip-172-30-2-151 proftpd[8624] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): USER conhecen: no such user found from host1.webinformativomarketing.com [95.110.236.43] to ::ffff:172.30.2.151:21
2016-04-14 14:00:13,134 ip-172-30-2-151 proftpd[8625] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session opened.
2016-04-14 14:00:13,239 ip-172-30-2-151 proftpd[8624] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session closed.
2016-04-14 14:00:13,356 ip-172-30-2-151 proftpd[8625] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): USER conhecen: no such user found from host1.webinformativomarketing.com [95.110.236.43] to ::ffff:172.30.2.151:21
2016-04-14 14:00:13,713 ip-172-30-2-151 proftpd[8626] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session opened.
2016-04-14 14:00:13,824 ip-172-30-2-151 proftpd[8625] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session closed.
2016-04-14 14:00:13,926 ip-172-30-2-151 proftpd[8626] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): USER conhecen: no such user found from host1.webinformativomarketing.com [95.110.236.43] to ::ffff:172.30.2.151:21
2016-04-14 14:00:14,298 ip-172-30-2-151 proftpd[8627] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session opened.
2016-04-14 14:00:14,404 ip-172-30-2-151 proftpd[8626] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session closed.
2016-04-14 14:00:14,521 ip-172-30-2-151 proftpd[8627] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): USER conhecen: no such user found from host1.webinformativomarketing.com [95.110.236.43] to ::ffff:172.30.2.151:21
2016-04-14 14:00:14,874 ip-172-30-2-151 proftpd[8628] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session opened.
2016-04-14 14:00:14,984 ip-172-30-2-151 proftpd[8627] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session closed.
2016-04-14 14:00:15,082 ip-172-30-2-151 proftpd[8628] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): USER conhecen: no such user found from host1.webinformativomarketing.com [95.110.236.43] to ::ffff:172.30.2.151:21
2016-04-14 14:00:15,516 ip-172-30-2-151 proftpd[8629] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session opened.
2016-04-14 14:00:15,620 ip-172-30-2-151 proftpd[8628] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): FTP session closed.
2016-04-14 14:00:15,739 ip-172-30-2-151 proftpd[8629] ip-172-30-2-151.ec2.internal (host1.webinformativomarketing.com[95.110.236.43]): USER conhecen: no such user found from host1.webinformativomarketing.com [95.110.236.43] to ::ffff:172.30.2.151:21
Há muitas! Isso pode fazer o servidor cair?
Quanto a memória, não, é um servidor produção.